Data processing and communications systems and methods for the efficient implementation of privacy by design

• US 10,353,674 B2
• Filed: 10/15/2018
• Issued: 07/16/2019
• Est. Priority Date: 06/10/2016
• Status: Active Grant

• Current Assignee: OneTrust LLC
• Original Assignee: OneTrust LLC
• Inventors: Barday, Kabir A.
• Primary Examiner(s): Korsak, Oleg
• Application Number:
  US16/160,577
• Publication Number:
  US 20190050205A1
• Time in Patent Office: 274 Days
• CPC Class Codes: G06F 8/20 Software design
• CPC Class Codes: G06F 8/30 Creation or generation of source code
• CPC Class Codes: G06F 8/73 Program documentation
• CPC Class Codes: G06F 8/75 Structural analysis for program understanding
• CPC Class Codes: G06Q 30/018 Certifying business or products
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]

Abstract

Data processing systems and methods for: (1) receiving from a first set of users, respective answers for question/answer pairings regarding a product'"'"'s proposed design; (2) using the question/answer pairings to prepare an initial privacy impact assessment for the product; (3) displaying the plurality of question/answer pairings to a second set of users; (4) receiving recommended steps to be implemented as part of the design of the product to address any privacy-related concerns identified in the initial privacy impact assessment; and (5) after the tasks have been completed, generating a report documenting that: (a) the initial privacy assessment has been conducted for the product; (b) one or more revisions have been made to the product to facilitate the compliance of the product with the one or more privacy standards; and (c) an updated privacy assessment has been conducted for the product.

Claims

1. A computer-implemented data processing method for demonstrating compliance with privacy-by-design practices, the method comprising:

automatically electronically analyzing, by one or more computer processors, computer code to determine one or more privacy-related attributes of the computer code, each of the privacy-related attributes indicating one or more types of personal information that the computer code collects or accesses;

in response to determining that the computer code has a particular one of the one or more privacy-related attributes;

(A) executing, by one or more computer processors, the steps of;

(i) electronically displaying one or more prompts to one or more first individuals requesting that the one or more first individuals input information regarding the particular privacy-related attribute;

(ii) receiving input information from the one or more first individuals regarding the particular privacy-related attribute; and

(iii) communicating the information regarding the particular privacy-related attribute to one or more second individuals for use in conducting a first privacy assessment of the computer code;

(B) changing, by one or more computer processors, an indicator associated with the code to indicate that the particular privacy-related attribute should be reviewed by one or more designated individuals; and

(C) changing, by one or more computer processors, an indicator associated with the computer code to indicate that the computer code should be modified to not include the particular privacy-related attribute;

receiving, by one or more computer processors, from the one or more second individuals, one or more revisions to the design of the computer code, the one or more revisions comprising one or more steps that facilitate the compliance of the computer code with one or more privacy standards;

in response to receiving the one or more revisions, automatically initiating, by one or more computer processors, the generation of at least one task that is to be used in managing the design of the computer code, the at least one task comprising one or more tasks that, if completed, would individually or collectively result in the one or more revisions to the design of the computer code;

receiving, by one or more computer processors, a notification that the at least one task has been completed;

at least partially in response to receiving the notification that the at least one task has been completed, generating, by one or more computer processors, a second, updated privacy assessment for the computer code that reflects the fact that the one or more revisions have been completed; and

generating, by one or more computer processors, a report listing the one or more revisions that have been completed.

2. The computer-implemented data processing method of claim 1, further comprising:

analyzing the one or more revisions to determine whether the one or more revisions substantively impact the computer code'"'"'s compliance with one or more privacy standards.

3. The computer-implemented data processing method of claim 2, wherein the step of analyzing the one or more revisions to determine whether the one or more revisions substantively impact the computer code'"'"'s compliance with one or more privacy standards comprises determining whether the one or more revisions revise the computer code by executing a step selected from a group consisting of:

(i) anonymizing personal data, and (ii) encrypting personal data.

4. The computer-implemented data processing method of claim 2, wherein the step of analyzing the one or more revisions to determine whether the one or more revisions substantively impact the product'"'"'s compliance with one or more privacy standards comprises determining whether the one or more revisions revise the product to minimize the use of personal data.

5. The computer-implemented data processing method of claim 1, wherein the one or more first individuals include one or more software developers.

6. The computer-implemented data processing method of claim 5, wherein the one or more second individuals comprise one or more privacy officers.

7. The computer-implemented data processing method of claim 1, wherein the product is a particular version of a particular software application.

8. The computer-implemented data processing method of claim 1, wherein the product is a computerized appliance.

9. The computer-implemented data processing method of claim 1, further comprising the step of displaying the updated privacy assessment to one or more users on a display screen.

10. The computer-implemented data processing method of claim 1, wherein the at least one task comprises changing the particular computer code to modify the way that it obtains, uses, or stores personal data.

11. A computer-implemented data processing method for demonstrating the compliance of an organization with privacy-by-design practices, the method comprising:

electronically obtaining, by one or more computer processors, computer code based on a location provided by one or more first individuals, of the computer code;

automatically electronically analyzing, by one or more computer processors, the computer code to determine one or more privacy-related attributes of the computer code, each of the privacy-related attributes indicating one or more types of personal information that the computer code collects or accesses;

in response to determining that the computer code has a particular one of the one or more privacy-related attributes;

executing, by one or more computer processors, the steps of;

(i) receiving input information from the one or more first individuals regarding the particular privacy-related attribute; and

(ii) communicating, by one or more computer processors, the information regarding the particular privacy-related attribute to one or more second individuals for use in conducting a first privacy assessment of the computer code;

receiving, from the one or more second individuals, one or more revisions to the design of the computer code comprising one or more steps that facilitate the compliance of the computer code with one or more privacy standards;

in response to receiving the one or more revisions, automatically initiating, by one or more computer processors, the generation of at least one task that, if completed, would individually or collectively result in the one or more revisions to the design of the computer code;

receiving a notification, by one or more computer processors, that the at least one task has been completed;

at least partially in response to receiving the notification that the at least one task has been completed, generating, by one or more computer processors, a second, updated privacy assessment for the computer code that reflects the fact that the one or more revisions have been completed; and

generating, by one or more computer processors, a report documenting that;

(1) the initial privacy assessment has been conducted;

(2) the one or more revisions have been made to the computer code to facilitate the compliance of the computer code with the one or more privacy standards; and

(3) the updated privacy assessment has been conducted.

12. The computer-implemented data processing method of claim 11, wherein the one or more first individuals comprise one or more software developers.

13. The computer-implemented data processing method of claim 11, wherein the one or more second individuals comprise one or more privacy officers.

14. The computer-implemented data processing method of claim 11, further comprising the step of displaying the report to one or more users on a display screen.

15. The computer-implemented data processing method of claim 11, wherein the at least one task comprises changing the computer code to modify the way that it obtains, uses, or stores personal data.

16. A computer system for efficiently demonstrating the compliance by an organization with privacy-by-design practices, the computer system comprising at least one computer processor and memory operatively coupled to the at least one processor, the computer system being configured for:

receiving a request to monitor one or more systems that are associated with development of a particular computer product that includes the computer code for new versions of the particular computer product;

monitoring one or more computer storage locations to determine whether any new versions of the computer product have been stored in the one or more computer storage locations;

determining that a new version of the particular computer product has been stored in the one or more computer storage locations based at least in part on one or more changes to the one or more systems that are associated with development of a particular computer product;

automatically electronically analyzing the new version of the particular computer product to determine one or more privacy-related attributes of the particular computer product, each of the privacy-related attributes indicating one or more types of personal information that the particular computer product collects or accesses;

in response to determining that the new version of the particular computer product has a particular one of the one or more privacy-related attributes;

(A) executing the steps of;

(i) electronically displaying one or more prompts to one or more first individuals requesting that the one or more first individuals input information regarding the particular privacy-related attribute; and

(ii) communicating the information regarding the particular privacy-related attribute to one or more second individuals for use in conducting a first privacy assessment of the new version of the particular computer product; and

(B) changing an indicator associated with the new version of the particular computer product to indicate that, before the new version of the particular computer product is launched, the new version of the particular computer product should be modified to not include the particular privacy-related attribute;

receiving, from the one or more second individuals, one or more revisions to a design of the particular computer product, the one or more revisions comprising one or more steps that facilitate the compliance of the particular computer product with one or more privacy standards;

in response to receiving the one or more revisions, automatically initiating, by one or more computer processors, the generation of at least one task that is to be used in managing the design of the particular computer product, the at least one task comprising one or more tasks that, if completed, would individually or collectively result in the one or more revisions to the design of the particular computer code;

receiving a notification that the at least one task has been completed;

at least partially in response to receiving the notification that the at least one task has been completed, generating, by one or more computer processors, an updated privacy assessment for the particular computer product that reflects the fact that the one or more revisions have been completed; and

generating a report indicating that the one or more revisions have been completed.

17. The computer system of claim 16, wherein the one or more first individuals comprise one or more software developers.

18. The computer system of claim 16, wherein the one or more second individuals comprise one or more privacy officers.

19. The computer system of claim 16, wherein the one or more systems comprise one or more systems that store personal data collected by the computer product.

20. The computer system of claim 16, wherein:

the computer product is a particular software application, and

the at least one task comprises changing the particular software application to modify the way that it obtains, uses, or stores personal data.